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(54) Title: METHOD FOR IMPROVED AUTHENTICATION FOR CELLULAR PHONE TRANSMISSIONS 



(57) Abstract 

An authentication process for a cellular phone network wherein if a 
subscriber attempts a call (100) an encrypted result, or a signed response, 
previously stored in the subscriber's cell phone, is transmitted (101) to 
a Mobile Switching Center (MSC). If the signed response matches the 
encrypted result (102) previously stored in an Authentication Center (AuC) 
access is granted and the call proceeds (104), if not the call is rejected 
(103). The Authentication Center (AuC) generates a random number (105) 
and derives a new encrypted result by means of a CAVE algorithm using 
the random number and the subscriber's unique key previously stored in 
a database at the AuC (106). This new encrypted result is stored (107) 
at the AuC replacing the previously-stored encrypted result, and a Mobile 
Switching Center (MSC) transmits the new random number to the cellular 
phone (108). The cellular phone then derives a new encrypted result, or a 
signed response (109). The new signed result is stored in the cellular phone 
replacing the previously stored signed response (110). 
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METHOD FOR IMPROVED AUTHENTICATION 
FOR CELLULAR PHONE TRANSMISSIONS 



5 



FIELD OF THE TNVTMTTON 



The present invention relates generally to a 



method for providing a cellular-phone with expedited call 
processing and a more secure calling environment/ and the 
present invention relates more specifically to a method 
for performing the transmission and calculation of 
messages/data utilized in an authentication procedure 
over more than one call so that each call proceeds faster 
and the decoding of the user' s unique key through the 
scanning of any single call is made substantially 
impossible . 

BACKGROUND INFORMATION 



In recent years, the use of cellular phones for both 
personal and business related communication has become 
more popular. The obvious appeal of wireless service is 
the portability of the telephone, with users no longer 
confined to a particular space or address. However, this 
portability also poses a dilemma for the cellular 
telephone system provider, which must determine the 
identity of the individual making or authorizing the call 
for billing purposes and decide if the individual is a 
subscriber i,,e L> determine whether the individual is 
entitled to make the call at all. 
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One common-way- to --authenticate" -callers, 

i..^, verify that they are who they claim to be, is set 
forth in FIG. 3. Each subscriber is provided with a 
unique, secret "key," which is also maintained in a 
database record kept by the cellular service provider, 
i^fL^, at the cellular service provider station. When a 
user wishes to make a call from a cellular terminal, 

when the user's phone goes off the hook, then in 
Step 202, the cellular-service provider transmits a 
signal representing a random number to the terminal. In 
Step 203, the terminal encrypts the random number with 
the user's unique key and a predetermined algorithm. 
Then in Step 204, the encrypted result is transmitted 
back to the cellular-service provider. There, the same 
random number is encrypted, again with the user's unique 
key and the same predetermined algorithm. m Step 206 
this encrypted result independently calculated by the 
cellular service provider is compared with that 
transmitted from the cellular terminal. If the 
comparison is a match, the caller is "authenticated" and 
the call is allowed to proceed. Otherwise, 
authentication fails, and the user is refused access to 
the cellular network. 

Unfortunately, the above described authentication 
procedure is not entirely satisfactory. It involves 
extensive calculation at both the user's terminal and the 
cellular service provider, as well as a number of 
transmissions between the two. Since a call is not 
allowed to proceed until the entire authentication is 
completed, call processing may be significantly delayed. 



mo 



In addition, it is relatively simple to scan or 
nitor cellular phone transactions such as the above- 
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described authentication procedure. Therefore, an 
un author i zed i nd i" vrdu a~l — c a n~ea"si~ry "ob t a rn~t he raindom 
number and encrypted response transmitted between the 
terminal and the cellular service provider. In addition, 
5 the predetermined algorithm used in encryption will often 

be well known in the art, £_,_g^-' CAVE algorithm. Thus, the 
only unknown for the unauthorized individual intending to 
circumvent the authentication security procedure via 
scanning is the user's unique key, which unfortunately 
10 may be decoded once the random number, encrypted result 

and ciphering algorithm are known. In fact, unauthorized 
cellular phone use is not unusual, and has significantly 
increased the industry's cost of doing business. 



15 Therefore, what is needed is an improved 

authentication procedure which does not unduly delay call 
processing and at the same time renders unauthorized 
cellular use less likely. 

20 

SUMMARY OF THE INVENTION 



It is an object of the present invention to greatly 
increase the difficulty of stealing and/or decoding of 
25 cellular phone encryption keys. 



It is another object of the present invention to 
prevent fraudulent cellular use occurring as a result of 
interception of transmission of encryption key data. 

It is yet another object of the present invention to 
provide a user-authentication for cellular-phone use, 
which method distributes transmission and calculation of 
messages/data utilized in the authentication method over 
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more_ than one call^ 

The present invention achieves the above objects by 
providing an alternative to the conventional 
5 authentication procedure. In accordance with the present 

invention, when a subscriber signs on for service, the 
subscriber is provided with a unique key and an initial 
encrypted number. The initial encrypted number may be 
stored in the subscriber's terminal. The cellular-service 
10 provider's Home Location Register also stores the same 

unique key and initial encrypted number in a database 
record associated with the subscriber. 

Once these preliminary steps are taken, the 
15 following improved authentication procedure according to 

the present invention may be utilized. When the 
subscriber's terminal goes off hook, i.e. , when the user 
intends to make or receive calls, the encrypted result 
stored in the terminal is transmitted to the cellular- 
20 service-provider station which compares the result to its 

own snored encrypted result. If the results match, the 
call is allowed to proceed. If not, the user is rejected 
access to the cellular network. 

25 During the call, the cellular-service-provider 

station transmits a random number to the terminal. The 
terminal and cellular-service-provider station then 
independently encrypt the random number with the same 
ciphering algorithm and user's unique key. The encrypted 

30 results are then stored at their respective locations at 

the terminal and cellular-service-provider station, 
replacing the encrypted results stored earlier. These 
encrypted results are in turn used the next time access 
to the cellular network is desired, i.e. , the next time 
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the phone goes off hook. Each subsequent time the phone 
goes of"f - hoo)c7~tfhe authentication procedure is again 
initiated from the terminal with transmission of its 
previously stored encrypted result for comparison at the 
cellular- service-provider station . 

As should be clear from the above description, the 
improved authentication procedure according to the 
present invention allows call processing to proceed more 
quickly. The call is allowed to proceed immediately, 
after transmission of an encrypted result from the 
terminal and a successful comparison of the encrypted 
result at the cellular-service-provider station. Call 
processing is not delayed by the transmission of the 
random number, or by any calculation at the cellular 
provider station or the terminal, as these take place 
after access to the cellular network is already allowed. 

In addition, the authentication procedure according 
to the present invention is an improvement on current 
practice in that the random number and the encrypted 
result obtained from that random number are not 
transmitted during the same call. Rather, for each call 
attempt, the previously stored encrypted result (obtained 
from the random number transmitted during the preceding 
call) and a new, unrelated random number (used to obtain 
a new encrypted result for a future call) are 
transmitted. Without both the encrypted result and the 
random number used to obtain it, it is substantially 
harder to determine the user's unique key. Furthermore, 
it would be impossible to decode the user's unique key by 
scanning just one call. Persons using a scanner to 
obtain information transmitted between the terminal and 
cellular-service-provider station would have to scan two 

5 
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stinc t call s„ . t o„ha ve_any_p.os s ibi 1 .i.ty_o.f . -decoding the 



user's key. As these calls may be hours or days apart, 
the possibility of decryption is significantly reduced. 

Further objects and advantages of the present 
invention will become apparent from a review of the 
detailed description provided below. 

BRIEF DESCRTPTTOM OF THF HRAWTNftS 

FIG. 1 illustrates the apparatus of a GSM cellular 
network, which is one possible implementation of the 
apparatus which utilizes the method of the present 
invention. 

FIG. 2 is a flow chart depicting an authentication 
procedure and one possible embodiment of the method of 
the present invention. 

FIG. 3 -is a flow chart depicting an authentication 
procedure in current use and is provided for comparison 
purposes to illustrate the advantages and benefits the 
present invention. 

25 DETAILED DESCRTPTT QN OF THE TNVEMTTON 

In one possible implementation, the method according 
to present invention may be used in a Global System for 
Mobile Communications ("GSM") type cellular network, the 
primary functional components of which network are shown 
in FIG. 1. it should be noted that FIG. 1 is by no means 
intended to describe in detail a GSM cellular network, 
but rather is a basic overview of certain major 
functional components sufficient to illustrate the method 
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according to the present invention described herein. 



Turning now to FIG • 1, the cellular terminal 1, also 
referred to as "mobile equipment," is portable, and held 
5 by a subscriber. For purposes of the present description, 

the cellular terminal 1 is assumed to be a cellular 
phone, but the present invention is of equal benefit to 
an individual attempting a fax or other transmission. 
The subscriber also carries a Subscriber Identity Module 

10 ("SIM") 6. Stored within the SIM 6 is an authentication 

key unique to the subscriber. When making a call, the 
subscriber inserts the SIM 6 into a slot on the cellular 
terminal 1, so that the cellular terminal 1 may read and 
transmit the authentication key each time the subscriber 

15 wishes to log on to the cellular network. 

Cellular transmissions from the cellular terminal 1 
are received at a Base Transceiver Station ("BTS") 2, 
which includes a series of radio transmitters. Each BTS 
20 2 covers a certain range in a discrete area. 

Accordingly, during a call the subscriber carrying a 
cellular terminal 1 may move in out of the range of a 
given BTS 2. 

25 Continuing with FIG. 1, a Base Station Controller 

("BSC") 3, which ensures call maintenance, is connected 
to a group of BTS's 2. Specifically, during a call, the 
cellular terminal 1 continuously transmits to the BSC 3 
the signal strength of each of the group of associated 

30 BTS's 2. The BSC 3 can then use these transmissions to 

determine whether the call should be switched to a new 
BTS 2, x , e , / whether the cellular terminal 1 
transmissions should be sent to a new BTS 2. 

7 
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From t-he BTS-'-s - 2 the - ee 1-1 u 1 a r :er-minal 1 



transmissions are received at the Mobile Switching Center 
("MSC") 4, which routes all incoming and outgoing 
transmissions to and from fixed-line telephone networks 5 
5 (such as Public Switched Telephone Networks ("PSTN") or 

Integrated Services Digital Network ("ISDN")) or other 
cellular networks. From such telephone networks, the 
call connection is completed. 

10 Th e MSC 4 shown in FIG. 1 is the heart of the 

cellular-service-provider's network. The MSC's 4 
functions include maintaining all necessary 
administrative and other subscriber information, such as 
registration and authentication information and location 
15 updates. Thus, the MSC 4 includes a number of 

databases, including the Home Location Register ("HLR") 7 
and associated Authentication Center ("AuC") 9. When 
access to the cellular network is desired, the HLR 7 
generally provides the functionality and information 
20 necessary for properly allowing or disallowing access. 

The AuC 9 also plays a role in this process by providing 
functionality and information necessary for the HLR 7 to 
authenticate a particular call. For example, when the 
HLR 7 receives a log-on request transmitted from the 
25 cellular terminal 1, the HLR 7 checks a signed response 

("SRES"), which is a portion of the log-on request 
transmission from the terminal, against an encrypted 
result generated by the AuC 9 for the subscriber. If the 
SRES transmitted from the cellular terminal 1 is the same 
as the encrypted result generated by the AuC 9, the MSC 4 
transmits to the cellular terminal 1 a message allowing 
network access. Otherwise, access to the cellular-phone- 
network is disallowed. 
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15 



20 



25 



The steps and operation of the authentication 
procedure according to the present invention, including 
the respective role of the HLR 7, AuC 9 and SRES, and 
advantages resulting from practice of the present 
invention, will become apparent from the following 
detailed description . 

Turning now to FIG. 2, a flow chart depicting an 
authentication procedure which is one possible embodiment 
of the method of the present invention, the 
authentication procedure according to the present 
invention assumes that certain preliminary administrative 
matters have been completed. 

Specifically, when a subscriber signs on for service 
with the cellular-service-provider, the subscriber 
receives a cellular terminal 1 as well as an SIM 6 card. 
As is common practice, an authentication key unique to 
the subscriber is stored in the SIM 6. In addition, a 
unique "initial encrypted result," i.e. , the above 
mentioned SRES is also stored in the cellular terminal 1. 
Both the subscriber's unique key and initial encrypted 
result are also stored in the AuC .9 of the MSC 4 as part 
of a database record associated with the subscriber. The 
subscriber is instructed to carry the SIM 6 with the 
cellular terminal 1, and to insert the SIM 6 into the 
cellular terminal 1 whenever the subscriber wishes to 
make or receive calls. 

Once the subscriber signs on for service, the 
following authentication procedure, illustrated in FIG. 
2, may be practiced whenever the subscriber wishes to 
make or receive calls. In Step 100, the subscriber at a 
cellular terminal 1 indicates an intent to make a call by 
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taking the phone "of f hook, " e.g. , by pressing a button 

or flipping a microphone, and inserting the SIM 6 into 
the cellular terminal 1. As a result, in Step 101, the 
cellular terminal 1 transmits the "SRES" stored within it 
5 to the appropriate BTS 2, and ultimately to the HLR 7. 

In general, the SRES is the encrypted result (stored in 
the cellular terminal 1) derived from a random number 
("RAND," transmitted from the AuC 9 during a prior call) 
by manipulation using the subscriber's unique key (stored 
10 in the SIM 6) and a ciphering algorithm, such as CAVE. 

However, as noted above, in the case of the subscriber's 
first call, the SRES is the initial encrypted result 
which the cellular service provider causes to be stored 
in the cellular terminal 1 prior to distribution. 

15 

When the SRES is received at the HLR 7, in Step 102, 
the HLR 7 checks the SRES against an encrypted result 
stored in a database record associated with the 
subscriber in the AuC 9. Again, if the subscriber's 

20 attempted call is the first request for network access, 

the encrypted result stored in the AuC 9 for the 
subscriber will be the same as the SRES stored by the 
cellular provider in the cellular terminal 1 prior to 
distribution of the terminal 1 to the subscriber. 

25 Otherwise, the encrypted result stored in the AuC 9 is 

derived from a random number (RAND, transmitted during a 
prior call to the cellular terminal 1) by manipulation 
using the subscriber's unique key (also stored in the AuC 
9) and the same ciphering algorithm used at the cellular 

30 terminal 1, such as CAVE . 

If the encrypted result stored in the AuC 9 does not 
match the SRES transmitted from the cellular terminal 1, 

10 
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then in Step 103 the HLR 7 rejects the request for 
cellula r "ne twork access. Otherwise, i~f~~the encryp t ed 
result stored in the AuC 9 matches the SRES transmitted 
from the cellular terminal 1, then in Step 104 the call 
5 is allowed and a message to that effect is transmitted 

back to the cellular terminal 1. 

Assuming the call is allowed to proceed, the 
authentication procedure according to the present 

10 invention continues and the call is connected. During 

call processing, in step 105, the AuC 9 generates a new 
random number (RAND) . Then, in step 106, the AuC 9 uses 
the same ciphering algorithm as the one used by the 
cellular terminal 1 to independently derive an encrypted 

15 result based on (RAND) and the subscriber's unique key 

stored in the AuC 9. In Step 107, the latest encrypted 
result of the ciphering algorithm is stored in the 
subscriber's database record in the AuC 9 for use in 
connection with a future request for network access, and 

20 the existing encrypted result previously stored in the 

AuC 9 is deleted. 

Once finished with its own encryption processing the 
AuC 9 transmits the ( RAND) generated in Step 106 to the 

25 cellular terminal 1 in Step 108. In Step 109, like the 

AuC 9, the cellular terminal ,1 then performs the same 
ciphering algorithm on the (RAND) using the subscriber's 
unique key stored in the SIM 6. The encrypted result, 
i.e. , the SRES obtained from applying the ciphering 

30 algorithm in Step 109 is stored in the terminal in Step 

110 for a future network access request, thus replacing 
the previously stored SRES in the terminal. 
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— Once the call has.- been completed, and the subscribe; 



makes another network-access request, the above-described 
authentication process will be repeated, beginning with 
step 100. 

A few points regarding the above embodiment of the 
present invention are worthy of note. First, call 
processing continues after transmission of an encrypted 
result from the cellular terminal 1 and a successful 
comparison or verification of the encrypted result at the 
AuC 9. Call processing is not delayed by the transmission 
of (RAND) or by the processing of a ciphering algorithm 
at the AuC 9 or the cellular terminal 1. 

In addition, the (RAND) and the encrypted result 
derived from the (RAND) are not transmitted during the 
same call. Rather, for each call attempt, the previously 
stored encrypted result, which is derived from the random 
number transmitted during an earlier call, and a new, 
unrelated random number, which is used to derive the 
encrypted result for a future call authentication, are 
transmitted. Thus, it would be substantially impossible 
to decode the subscriber's unique key scanning just one 
call. 

Finally, it should be noted that while the present 
invention has been described in the above specification, 
in connection with an exemplary embodiment, the present 
invention is by. no means limited thereby. Numerous minor 
modifications and alterations may be made to the above 
described embodiment without departing from the scope of 
the present invention. For example, although the 
ciphering algorithms used by the cellular terminal 1 and 
the AuC 9 have been described as being identical, it need 

12 
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not be so: the cellular terminal, and the AuC 9 may use 
dif f ere nt " c: i ph er i ng algorithms as long as bot h algorit hm s 
produce an identical encrypted result based on the same 
input. In addition, although the ciphering algorithm 
used in the present invention has been described as the 
CAVE algorithm, any other number-manipulating algorithm 
may be used as the ciphering algorithm. 
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What- Is ClaimPri T F - 

1 1. As a part of a cellular-phone-call- 

2 initiating process, a method for authenticating a caller 



3 — wu^.^.\ 

3 seeking access to a telephone network via transmission 

4 from a cellular terminal through a cellular-phone- 
service-provider station, each of said cellular terminal 
and said cellular-phone-service-provider station having a 
previously stored encrypted result and a unique key 
assigned to the caller, the method comprising the steps 



5 
6 
7 
8 

9 of: 



10 
11 
12 
13 
14 
15 
16 



a. transmitting, from said cellular terminal, said 
previously-stored encrypted result to said 
cellular-phone-service-provider station; 

b. authenticating by comparison whether said 
encrypted result transmitted from said cellular 
terminal matches said encrypted result 
previously stored in said cellular-phone- 

17 service-provider station; 

18 c * calculating, at the cellular-phone-service- 
provider station, a new encrypted result by 
means of a first ciphering algorithm using a 
random number and said unique key assigned to 

22 the caller; 

23 d * transmitting said random number from said 

24 cellular-phone-service-provider station to said 

25 cellular terminal; and 

26 e * independent of said calculation in step (c) , 
I] calculating, at the cellular terminal, said new 

encrypted result by means of a second ciphering 
algorithm using said transmitted random number 
and said unique key assigned to the caller; 
wherein said new encrypted result calculated in step 
(c) is stored in said cellular-phone-service-provider 



19 
20 
21 



28 
29 
30 
31 
32 



14 



SUBSTITUTE SHEET (RULE 26) 



WO 99/49616 



PCT/US99/06426 



33 station and said new encrypted result calculated in step 

3 -4 ( e") — i^r~sXj5T€QT~v^ 

35 authentication attempt. 

1 2. The method according to claim 1, further 

2 comprising the step of: 

3 between steps (b) and (c) , facilitating access 

4 to the telephone network for the caller if said encrypted 

5 result transmitted from said cellular terminal matches 

6 said encrypted result previously stored in said cellular- 

7 phone-service-provider station. 

1 3. The method according to claim 2, wherein 

2 said step of facilitating access to the telephone network 

3 is performed at said cellular-phone-service-provider 

4 station. 

1 4. The method according to claim 3, wherein 

2 step (b) is performed at said eel lular-phone-service- 

3 provider station. 

1 5. The method according to claim 4, wherein 

2 said first ciphering algorithm is a CAVE algorithm. 

1 6. The method according to claim 5, wherein 

2 said second ciphering algorithm is a CAVE algorithm. 

1 7. The method according to claim 6, wherein 

2 said cellular terminal comprises a cellular telephone and 

3 said cellular-phone-service-provider station comprises a 

4 mobile switching center. 

1 8. The method according to claim 1, wherein 

2 step (b) is performed at said cellular-phone-service- 
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4 



is 



3 provider station. 

1 9. The method according to claim 8, further 

2 comprising the step of: 

3 between steps (b) and (c) , facilitating accesj 
to the telephone network for the caller if said encrypted 

5 result transmitted from said cellular terminal matches 

6 said encrypted result previously stored in said cellular- 

7 phone-service-provider station. 

1 10. The method according to claim 9, wherein 

2 said first and second ciphering algorithms are a CAVE 

3 algorithm. 

1 11. A method for authenticating a caller 

2 seeking access to a telephone network via transmission 

3 from a cellular terminal through a cellular-phone- 

4 service-provider station, which method minimizes the 

5 amount of transmission and calculation involved in 
authenticating said caller, each of said cellular 
terminal and said cellular-phone-service-provider station 
having a previously stored check message and a unique key 
assigned to the caller, the method comprising the steps 



o 
7 
8 
9 

10 of 



11 a. 

12 
13 

14 b. 

15 
16 
17 

18 c. 

19 

20 



transmitting, from said cellular terminal, said 
previously-stored check message to said 
cellular-phone -service-provider station; 
authenticating by comparison whether said check 
message transmitted from said cellular terminal 
matches said check message previously stored in 
said ceilular-phone-service-provider station; 
facilitating access to the telephone network 
for the caller if said check message 
transmitted from said cellular terminal matches 
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21 said check message previously rtored in said 

22 ceTlUl a r - p ho ne~service -pro v "id e r s tTa tTion; 

23 d. calculating, at the cellular-phone-service- 

2 4 provider station, a new check message by means 

25 of a first ciphering algorithm using a first 

26 check element and a second check element; 

27 e- transmitting said first check element from said 

28 cellular-phone-service-provider station to said 

29 cellular terminal; and 

30 f. independent of said calculation in step (d) , 

31 calculating, at the cellular terminal, said new 

32 check message by means of a second ciphering 

33 algorithm using said transmitted first check 

34 element and said second check element; 

35 wherein said new check message calculated in step 

36 (d) is stored in said cellular-phone-service-provider 

37 station and said new check message calculated in step (f) 

38 is stored in said cellular terminal for next 

39 authentication attempt. 

1 12. The method according to claim 11, wherein 

2 said first check element comprises a random number. 

1 13. The method according to claim 12,. wherein 

2 said second check element comprises said unique key 

3 assigned to the caller. 

1 14. The method according to claim 13, wherein 

2 said first ciphering algorithm is a CAVE algorithm. 

1 15. The method according to claim 14, wherein 

2 said second ciphering algorithm is a CAVE algorithm. 

1 16. The method according to claim 15, wherein 
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2 said cellular terminal comprises a cellular telephone and 

3 said cellular-phone-service-provider station comprises a 

4 mobile switching center, 

1 17. The method according to claim 16, wherein 

2 said method is automatically initiated each time said 

3 cellular terminal is activated for use. 



1 18. The method according to claim 17, wherein 

2 said telephone network comprises one of a PSTN- type 

3 network and an ISDN- type network. 
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